/**
 * 
 */
package edu.gtcfla.km.platform.appmodules.web;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.session.SessionException;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.mgt.WebSecurityManager;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

import edu.gtcfla.km.security.PasswordErrorException;
import edu.gtcfla.km.security.token.CasUserToken;

/**
 * @author Bill Vison
 * 
 */
@Controller
public class LoginAndLogoutController {

	private final static Logger logger = LoggerFactory.getLogger(LoginAndLogoutController.class);

	@Autowired(required = false)
	public WebSecurityManager securityManager;

	@RequestMapping(value = "/login.act")
	public String  login(String username, String password,
			String saasaccount, HttpServletRequest request,
			HttpServletResponse response)  {
	

		logger.debug(" Login Username : " + username);

	
		// --- ioc security manager
		SecurityUtils.setSecurityManager(securityManager);

		Subject currSubject = SecurityUtils.getSubject();
		
		String res = "";
		try {
			
			String sid = null;

			// --- check and login user ---
			if (!currSubject.isAuthenticated()) {
				
				
				// --- add cas handle ---
				UsernamePasswordToken token = new UsernamePasswordToken(username,
						password);
				token.setRememberMe(true);



				// authenticate from remote server using http client vilidate
				currSubject.login( token );


			} else {
				PrincipalCollection priColl = currSubject.getPrincipals();
			}
			
		
			StringBuilder toUrl = new StringBuilder("redirect:");
			toUrl.append("/apps/km/index.htm");
			
			res = toUrl.toString();
			
		} catch (UnknownAccountException uae) {
			
			res = "login_default";
			String msg = "该帐号不存在!";
			request.setAttribute("errorMsg", msg);
			

		} catch (PasswordErrorException pee) {
			res = "login_default";
			String msg = "输入密码有误!";
			request.setAttribute("errorMsg", msg);
		}
		
		return res; 


	}


	@RequestMapping(value = "/logout.htm")
	public String  logout() throws Exception {


        Subject subject = SecurityUtils.getSubject();
        
        try {
            subject.logout();
            
        } catch (SessionException ise) {
            logger.debug("Encountered session exception during logout.  This can generally safely be ignored.", ise);
        }
		// --- old system support compatible . if no use , please remove this

		// --- to controller ---
		
		StringBuilder toUrl = new StringBuilder("redirect:");
		toUrl.append("/login_default.jsp");

		return toUrl.toString(); 


	}
}
